@oneidentity/safeguard 8.0.1 → 8.0.2

package/dist/browser-Df-ljVNJ.d.ts

@@ -1,447 +0,0 @@
-//#region src/http/types.d.ts
-/**
- * Platform-agnostic HTTP client interface for the Safeguard SDK.
- */
-interface HttpRequestOptions {
-  url: string;
-  method: string;
-  headers?: Record<string, string>;
-  body?: string | Buffer | null;
-  signal?: AbortSignal;
-  timeout?: number;
-}
-interface HttpResponse {
-  status: number;
-  headers: Record<string, string>;
-  body: string;
-}
-/**
- * Abstract HTTP client interface.
- * Implementations: NodeHttpClient (undici), BrowserHttpClient (fetch).
- */
-interface HttpClient {
-  request(options: HttpRequestOptions): Promise<HttpResponse>;
-  dispose?(): void;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/storage/types.d.ts
-/**
- * Interface for token/state storage backends.
- */
-interface StorageProvider {
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-/** Well-known storage keys used by the SDK. */
-declare const StorageKeys: {
-  readonly STATE: "safeguard_state";
-  readonly CODE_VERIFIER: "safeguard_code_verifier";
-};
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/secret.d.ts
-/**
- * A wrapper that prevents accidental logging of sensitive values.
- *
- * - `toString()` returns "[REDACTED]"
- * - `toJSON()` returns "[REDACTED]"
- * - `console.log(secretValue)` prints "[REDACTED]"
- * - `.expose()` returns the raw value when intentionally needed
- */
-declare class SecretValue {
-  #private;
-  constructor(value: string);
-  /** Returns the raw secret. Use only when you intentionally need the plaintext. */
-  expose(): string;
-  toString(): string;
-  toJSON(): string;
-  get [Symbol.toStringTag](): string;
-}
-//# sourceMappingURL=secret.d.ts.map
-//#endregion
-//#region src/auth/types.d.ts
-/**
- * Token set returned by authentication.
- */
-interface TokenSet {
-  /** The Safeguard user access token (wrapped to prevent accidental logging). */
-  accessToken: SecretValue;
-  /** Token lifetime in seconds from when it was issued. */
-  expiresIn?: number;
-  /** Timestamp (ms since epoch) when the token was acquired. */
-  acquiredAt: number;
-}
-/**
- * Auth strategy interface. All authentication methods implement this.
- */
-interface Auth {
-  /**
-   * Authenticate against the Safeguard RSTS and return a token set.
-   * @param host - Appliance hostname
-   * @param httpClient - HTTP client to use for requests
-   * @param storage - Storage provider for persisting tokens/state
-   */
-  authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet>;
-  /**
-   * Refresh the token if possible. Returns new token set or null if refresh not supported.
-   */
-  refreshToken?(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
-  /** Human-readable description of this auth strategy (for logging). */
-  readonly description: string;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/types.d.ts
-/**
- * Safeguard appliance service endpoints.
- */
-declare enum Service {
-  CORE = "core",
-  APPLIANCE = "appliance",
-  NOTIFICATION = "notification",
-  A2A = "a2a",
-  EVENT = "event",
-  RSTS = "RSTS",
-}
-/**
- * HTTP methods supported by the Safeguard API.
- */
-declare enum HttpMethod {
-  GET = "GET",
-  POST = "POST",
-  PUT = "PUT",
-  DELETE = "DELETE",
-  PATCH = "PATCH",
-}
-/**
- * Full response from a Safeguard API call (returned when fullResponse: true).
- */
-interface SafeguardResponse<T = unknown> {
-  data: T;
-  status: number;
-  headers: Record<string, string>;
-}
-/**
- * Options for individual API requests.
- */
-interface RequestOptions {
-  /** Request body as JSON-serializable object. */
-  json?: unknown;
-  /** Raw request body. */
-  body?: BodyInit | null;
-  /** Additional HTTP headers. */
-  headers?: Record<string, string>;
-  /** URL query parameters. */
-  query?: Record<string, string | number | boolean>;
-  /** AbortSignal for request cancellation. */
-  signal?: AbortSignal;
-  /** Request timeout in milliseconds (overrides client default). */
-  timeout?: number;
-  /** If true, returns full response with status and headers. */
-  fullResponse?: boolean;
-}
-/**
- * Options for constructing a SafeguardClient.
- */
-interface SafeguardClientOptions {
-  /** Authentication strategy. */
-  auth: Auth;
-  /** Custom CA certificate (PEM string or Buffer). Node.js only. */
-  ca?: string | Buffer;
-  /** Whether to verify TLS certificates. Default: true. */
-  verify?: boolean;
-  /** Safeguard API version prefix. Default: 'v4'. */
-  apiVersion?: string;
-  /** Request timeout in milliseconds. Default: 300_000 (5 min). */
-  timeout?: number;
-  /** Auto-refresh tokens before expiry. Default: true. */
-  autoRefresh?: boolean;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/errors.d.ts
-/**
- * Error hierarchy for the Safeguard SDK.
- *
- * SafeguardError
- * ├── ApiError              (HTTP errors from Safeguard API)
- * │   ├── AuthenticationError  (401)
- * │   ├── AuthorizationError   (403)
- * │   └── NotFoundError        (404)
- * ├── TransportError        (Network/connection failures)
- * └── ConfigurationError    (Invalid client options)
- */
-declare class SafeguardError extends Error {
-  constructor(message: string, options?: ErrorOptions);
-}
-interface ApiErrorBody {
-  Code?: string;
-  Message?: string;
-  InnerError?: {
-    Message?: string;
-  };
-  [key: string]: unknown;
-}
-declare class ApiError extends SafeguardError {
-  readonly status: number;
-  readonly body: ApiErrorBody | null;
-  constructor(message: string, status: number, body?: ApiErrorBody | null, options?: ErrorOptions);
-  /**
-   * Creates an appropriate ApiError subclass based on HTTP status code.
-   */
-  static fromResponse(status: number, body: string | ApiErrorBody | null): ApiError;
-  private static parseBody;
-  private static buildMessage;
-}
-declare class AuthenticationError extends ApiError {
-  constructor(message: string, body?: ApiErrorBody | null, options?: ErrorOptions);
-}
-declare class AuthorizationError extends ApiError {
-  constructor(message: string, body?: ApiErrorBody | null, options?: ErrorOptions);
-}
-declare class NotFoundError extends ApiError {
-  constructor(message: string, body?: ApiErrorBody | null, options?: ErrorOptions);
-}
-declare class TransportError extends SafeguardError {
-  constructor(message: string, options?: ErrorOptions);
-}
-declare class ConfigurationError extends SafeguardError {
-  constructor(message: string, options?: ErrorOptions);
-}
-//# sourceMappingURL=errors.d.ts.map
-//#endregion
-//#region src/utils.d.ts
-/**
- * Builds the base URL for a Safeguard service endpoint.
- *
- * @example
- * buildServiceUrl('appliance.example.com', Service.CORE)
- * // => 'https://appliance.example.com/service/core/v4'
- */
-declare function buildServiceUrl(host: string, service: Service, apiVersion?: string): string;
-/**
- * Builds a full API URL including path and optional query parameters.
- *
- * @example
- * buildRequestUrl('appliance.example.com', Service.CORE, 'Users', { filter: 'Name eq "admin"' })
- * // => 'https://appliance.example.com/service/core/v4/Users?filter=Name+eq+%22admin%22'
- */
-declare function buildRequestUrl(host: string, service: Service, relativeUrl: string, query?: Record<string, string | number | boolean>, apiVersion?: string): string;
-/**
- * Encodes bytes to a URL-safe base64 string (no padding).
- */
-declare function base64UrlEncode(bytes: Uint8Array): string;
-/**
- * Generates a cryptographically random code verifier for PKCE.
- * Returns a 43-character base64url string (32 random bytes).
- */
-declare function generateCodeVerifier(): string;
-/**
- * Computes the S256 code challenge from a code verifier.
- * Uses Web Crypto API (available in Node 20+ and all modern browsers).
- */
-declare function generateCodeChallenge(verifier: string): Promise<string>;
-/**
- * Generates a random state parameter for OAuth flows.
- */
-declare function generateState(): string;
-/**
- * Extracts the `exp` claim from a JWT and returns expiresIn (seconds from now).
- * Returns undefined if the token is not a valid JWT or has no `exp` claim.
- */
-//#endregion
-//#region src/storage/memory.d.ts
-/**
- * In-memory storage provider. Default for Node.js environments.
- * Data does not persist across process restarts.
- */
-declare class MemoryStorage implements StorageProvider {
-  #private;
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-//# sourceMappingURL=memory.d.ts.map
-//#endregion
-//#region src/storage/session.d.ts
-/**
- * Browser sessionStorage adapter. Data persists for the browser tab lifetime.
- * Requires a DOM environment (browser or jsdom).
- */
-declare class BrowserSessionStorage implements StorageProvider {
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-//# sourceMappingURL=session.d.ts.map
-//#endregion
-//#region src/http/browser.d.ts
-/**
- * Browser HTTP client using native fetch API.
- * No TLS configuration needed — browser handles certificates.
- */
-declare class BrowserHttpClient implements HttpClient {
-  #private;
-  constructor(options?: {
-    credentials?: RequestCredentials;
-  });
-  request(options: HttpRequestOptions): Promise<HttpResponse>;
-}
-//# sourceMappingURL=browser.d.ts.map
-//#endregion
-//#region src/auth/password.d.ts
-interface PasswordAuthOptions {
-  username: string;
-  password: string;
-  /** Identity provider name. Default: 'local'. */
-  provider?: string;
-}
-/**
- * Authenticates using username/password via RSTS Resource Owner grant.
- */
-declare class PasswordAuth implements Auth {
-  #private;
-  constructor(options: PasswordAuthOptions);
-  get description(): string;
-  authenticate(host: string, httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-  refreshToken(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
-}
-//# sourceMappingURL=password.d.ts.map
-//#endregion
-//#region src/auth/pkce.d.ts
-interface PkceAuthOptions {
-  /** OAuth redirect URI (must match RSTS configuration). */
-  redirectUri: string;
-  /** Identity provider name. Default: 'local'. */
-  provider?: string;
-}
-/**
- * Authenticates using PKCE (Proof Key for Code Exchange) with browser redirect.
- * For browser environments where the user is redirected to RSTS login.
- */
-declare class PkceAuth implements Auth {
-  #private;
-  constructor(options: PkceAuthOptions);
-  get description(): string;
-  /**
-   * Initiates the PKCE flow. If a stored authorization code exists (from callback),
-   * exchanges it for a token. Otherwise, redirects to RSTS login.
-   */
-  authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=pkce.d.ts.map
-//#endregion
-//#region src/auth/pkce-callback.d.ts
-interface PkceCallbackResult {
-  code: string;
-  state: string;
-}
-/**
- * Parses the PKCE callback URL and stores the authorization code.
- * Call this on the callback/redirect page to complete the PKCE flow.
- *
- * This is the explicit replacement for the legacy `safeguardJsAccessTokenChecker.js`
- * script that ran as a side-effect on import.
- *
- * @param storage - StorageProvider to persist the code
- * @param url - The callback URL to parse (defaults to window.location.href)
- * @returns The parsed code and state, or null if not a valid callback
- */
-declare function handlePkceCallback(storage: StorageProvider, url?: string): PkceCallbackResult | null;
-//# sourceMappingURL=pkce-callback.d.ts.map
-//#endregion
-//#region src/auth/token.d.ts
-interface TokenAuthOptions {
-  /** Pre-existing Safeguard access token. */
-  accessToken: string;
-}
-/**
- * Uses a pre-existing access token. No authentication flow — the token is assumed valid.
- * Useful when tokens are obtained externally or for service-to-service scenarios.
- */
-declare class TokenAuth implements Auth {
-  #private;
-  constructor(options: TokenAuthOptions);
-  get description(): string;
-  authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=token.d.ts.map
-//#endregion
-//#region src/auth/anonymous.d.ts
-/**
- * Anonymous authentication — no credentials.
- * Used for accessing public Safeguard endpoints (e.g., appliance status).
- */
-declare class AnonymousAuth implements Auth {
-  get description(): string;
-  authenticate(_host: string, _httpClient: HttpClient, _storage: StorageProvider): Promise<TokenSet>;
-}
-//# sourceMappingURL=anonymous.d.ts.map
-//#endregion
-//#region src/client.d.ts
-/**
- * Main entry point for the Safeguard SDK.
- * Instance-based — no global state. Multiple clients to different appliances are supported.
- */
-declare class SafeguardClient {
-  #private;
-  constructor(host: string, options: SafeguardClientOptions);
-  /** The appliance hostname this client connects to. */
-  get host(): string;
-  /** The API version prefix (e.g. 'v4'). */
-  get apiVersion(): string;
-  /** Custom CA certificate, if provided. */
-  get ca(): string | Buffer | undefined;
-  /** Whether TLS verification is enabled. */
-  get verify(): boolean;
-  /** Whether the client has an active authenticated session. */
-  get isConnected(): boolean;
-  /**
-   * Sets a custom StorageProvider (e.g., BrowserSessionStorage).
-   * Must be called before connect().
-   */
-  setStorage(storage: StorageProvider): this;
-  /**
-   * Sets the HttpClient implementation. If not called, must be set before connect().
-   * The factory pattern allows platform-specific client injection:
-   *   - Node: `new NodeHttpClient({ ca, rejectUnauthorized })`
-   *   - Browser: `new BrowserHttpClient()`
-   */
-  setHttpClient(httpClient: HttpClient): this;
-  /**
-   * Authenticate and establish a session.
-   * @throws {AuthenticationError} if authentication fails
-   * @throws {ConfigurationError} if httpClient not set
-   */
-  connect(): Promise<void>;
-  /**
-   * Disconnect — dispose HTTP client and clear token.
-   */
-  disconnect(): Promise<void>;
-  /**
-   * Returns seconds until the current access token expires, or -1 if unknown.
-   */
-  getAccessTokenLifetimeRemaining(): number;
-  get<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  post<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  put<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  delete<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  patch<T = unknown>(service: Service, relativeUrl: string, options?: RequestOptions): Promise<T>;
-  /**
-   * Low-level request method. Convenience verbs delegate here.
-   *
-   * When `options.fullResponse` is true, returns SafeguardResponse<T> with status + headers.
-   * Otherwise returns just the parsed response body as T.
-   */
-  invoke<T = unknown>(service: Service, method: HttpMethod, relativeUrl: string, options?: RequestOptions): Promise<T>;
-}
-//# sourceMappingURL=client.d.ts.map
-
-//#endregion
-export { AnonymousAuth, ApiError, type ApiErrorBody, type Auth, AuthenticationError, AuthorizationError, BrowserHttpClient, BrowserSessionStorage, ConfigurationError, type HttpClient, HttpMethod, type HttpRequestOptions, type HttpResponse, MemoryStorage, NotFoundError, PasswordAuth, type PasswordAuthOptions, PkceAuth, type PkceAuthOptions, type PkceCallbackResult, type RequestOptions, SafeguardClient, type SafeguardClientOptions, SafeguardError, type SafeguardResponse, SecretValue, Service, StorageKeys, type StorageProvider, TokenAuth, type TokenAuthOptions, type TokenSet, TransportError, base64UrlEncode, buildRequestUrl, buildServiceUrl, generateCodeChallenge, generateCodeVerifier, generateState, handlePkceCallback };
-//# sourceMappingURL=browser-Df-ljVNJ.d.ts.map

package/dist/browser-Df-ljVNJ.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"browser-Df-ljVNJ.d.ts","names":[],"sources":["../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/types.ts","../src/errors.ts","../src/utils.ts","../src/storage/memory.ts","../src/storage/session.ts","../src/http/browser.ts","../src/auth/password.ts","../src/auth/pkce.ts","../src/auth/pkce-callback.ts","../src/auth/token.ts","../src/auth/anonymous.ts","../src/client.ts"],"mappings":";;AAIA;;AAGY,UAHK,kBAAA,CAGL;KACM,EAAA,MAAA;QACP,EAAA,MAAA;EAAW,OAAA,CAAA,EAFV,MAEU,CAAA,MAAA,EAAA,MAAA,CAAA;EAIL,IAAA,CAAA,EAAA,MAAA,GALC,MAKW,GAAA,IAElB;EAqBM,MAAA,CAAA,EA3BN,WA2BgB;EAAA,OAAA,CAAA,EAAA,MAAA;;AACqB,UAxB/B,YAAA,CAwB+B;QAAR,EAAA,MAAA;EAAO,OAAA,EAtBpC,MAsBoC,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;;;AGXiC,UHU/D,UAAA,CGV+D;SAKtC,CAAA,OAAA,EHMvB,kBGNuB,CAAA,EHMF,OGNE,CHMM,YGNN,CAAA;SAAqB,GAAA,EAAA,IAAA;;;;;;AH3B/D;;AAGY,UCJK,eAAA,CDIL;KACM,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;KACP,CAAA,GAAA,EAAA,MAAA,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAW,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAIL,KAAA,EAAA,EAAA,IAAA;AAuBjB;;AACmB,cC1BN,WD0BM,EAAA;WAA6B,KAAA,EAAA,iBAAA;WAAR,aAAA,EAAA,yBAAA;AAAO,CAAA;;;;;AAjC/C;;;;;AAKsB;AAItB;AAuBiB,cE1BJ,WAAA,CF0Bc;EAAA,CAAA,OAAA;aACR,CAAA,KAAA,EAAA,MAAA;;QAAqB,CAAA,CAAA,EAAA,MAAA;EAAO,QAAA,CAAA,CAAA,EAAA,MAAA;;OEFxC,MAAA,CAAO,WAAW;;ADhCzB;;;;;;ADMsB,UGFL,QAAA,CHEK;EAIL;EAuBA,WAAA,EG3BF,WH2BY;EAAA;WACR,CAAA,EAAA,MAAA;;YAAqB,EAAA,MAAA;AAAO;;;;AClC9B,UEgBA,IAAA,CFhBe;EAQnB;;;;ACDb;;yCCgByC,qBAAqB,kBAAkB,QAAQ;;AAnBxF;AAYA;EAAqB,YAAA,EAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EAYqB,UAZrB,EAAA,OAAA,EAY0C,eAZ1C,CAAA,EAY4D,OAZ5D,CAYoE,QAZpE,GAAA,IAAA,CAAA;;WAOyC,WAAA,EAAA,MAAA;;;;;;AHtB9D;;AAGY,aIJA,OAAA;MJKM,GAAA,MAAA;WACP,GAAA,WAAA;EAAW,YAAA,GAAA,cAAA;EAIL,GAAA,GAAA,KAAA;EAuBA,KAAA,GAAA,OAAU;EAAA,IAAA,GAAA,MAAA;;;;AACoB;aItBnC,UAAA;;;EHZK,GAAA,GAAA,KAAA;EAQJ,MAAA,GAAA,QAGH;;;;ACJV;;UEgBiB;QACT;EDpBS,MAAA,EAAA,MAAQ;EAYR,OAAI,ECUV,MDVU,CAAA,MAAA,EAAA,MAAA,CAAA;;;;;AAO2D,UCS/D,cAAA,CDT+D;;MAKjB,CAAA,EAAA,OAAA;;MAAkB,CAAA,ECQxE,QDRwE,GAAA,IAAA;EAAO;YCU5E;;UAEF;EAxCE;EAYA,MAAA,CAAA,EA8BD,WA9BW;EAWL;EAAiB,OAAA,CAAA,EAAA,MAAA;;cAGvB,CAAA,EAAA,OAAA;AAAM;AAMjB;;;AAMY,UAcK,sBAAA,CAdL;;MAID,EAU4B,IAV5B;EAAW;EAUL,EAAA,CAAA,EAAA,MAAA,GAID,MAJC;EAAsB;QAAA,CAAA,EAAA,OAAA;;EAIjB,UAAA,CAAA,EAAA,MAAA;;;;EC/CT,WAAA,CAAA,EAAA,OAAe;;;;;;ALR5B;;;;;AAKsB;AAItB;AAuBA;;;AACgD,cKzBnC,cAAA,SAAuB,KAAA,CLyBY;aAAR,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EKxBC,YLwBD;AAAO;UKlB9B,YAAA;;;EJhBA,UAAA,CAAA,EAAA;IAQJ,OAAA,CAAA,EAGH,MAAA;;;;ACJG,cGgBA,QAAA,SAAiB,cAAA,CHSL;;iBGPR;sDAEoC,+BAAsC;EFvB1E;AAYjB;;SAOyC,YAAA,CAAA,MAAA,EAAA,MAAA,EAAA,IAAA,EAAA,MAAA,GEcY,YFdZ,GAAA,IAAA,CAAA,EEckC,QFdlC;iBAAqB,SAAA;iBAA0B,YAAA;;AAK9C,cE4C7B,mBAAA,SAA4B,QAAA,CF5CC;aAAqB,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EE6C1B,YF7C0B,GAAA,IAAA,EAAA,OAAA,CAAA,EE6CY,YF7CZ;;AAAkB,cEmDpE,kBAAA,SAA2B,QAAA,CFnDyC;EAAO,WAAA,CAAA,OAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EEoDnD,YFpDmD,GAAA,IAAA,EAAA,OAAA,CAAA,EEoDb,YFpDa;;cE0D3E,aAAA,SAAsB,QAAA;sCACE,+BAAsC;ADvF3E;AAYY,cCiFC,cAAA,SAAuB,cAAA,CDjFd;EAWL,WAAA,CAAA,OAAA,EAAiB,MAAA,EAAA,OAAA,CAAA,ECuEO,YDvEP;;AAC1B,cC4EK,kBAAA,SAA2B,cAAA,CD5EhC;aAEG,CAAA,OAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EC2E8B,YD3E9B;AAAM;AAMjB;;;AJCA;;;;;AAC+C;;iBMW/B,eAAA,wBAAuC;;AL7CvD;AAQA;;;;ACDA;iBIoDgB,eAAA,wBAEL,sCAED;;;AH3DV;AAYiB,iBGkED,eAAA,CHlEK,KAAA,EGkEkB,UHlElB,CAAA,EAAA,MAAA;;;;;AAO2D,iBGoEhE,oBAAA,CAAA,CHpEgE,EAAA,MAAA;;;;;AAKQ,iBGyElE,qBAAA,CHzEkE,QAAA,EAAA,MAAA,CAAA,EGyEzB,OHzEyB,CAAA,MAAA,CAAA;;;;AC5B5E,iBE+GI,aAAA,CAAA,CF/GG,EAAA,MAAA;AAYnB;AAWA;;;;;AJtBA;;;;AAKW,cOHE,aAAA,YAAyB,ePG3B,CAAA;EAAW,CAAA,OAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAElB,IAAA;EAqBM,GAAA,CAAA,GAAA,EAAA,MAAU,EAAA,KAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,MAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,IAAA;OACR,CAAA,CAAA,EAAA,IAAA;;;;;AAjCnB;;;;AAKW,cQHE,qBAAA,YAAiC,eRGnC,CAAA;EAAW,GAAA,CAAA,GAAA,EAAA,MAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAIL,GAAA,CAAA,GAAA,EAAA,MAAY,EAAA,KAAA,EAAA,MAElB,CAAA,EAAM,IAAA;EAqBA,MAAA,CAAA,GAAA,EAAA,MAAU,CAAA,EAAA,IAAA;EAAA,KAAA,CAAA,CAAA,EAAA,IAAA;;;;;AAhC3B;;;;AAKW,cSHE,iBAAA,YAA6B,UTG/B,CAAA;EAAW,CAAA,OAAA;EAIL,WAAA,CAAA,OAuBU,CAvBE,EAAA;IAuBZ,WAAU,CAAA,ES3Ba,kBT2Bb;EAAA,CAAA;SACR,CAAA,OAAA,ESxBM,kBTwBN,CAAA,ESxB2B,OTwB3B,CSxBmC,YTwBnC,CAAA;;;;;AA9BP,UUAK,mBAAA,CVAL;UACM,EAAA,MAAA;UACP,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAuB7B;;;;AACwC,cUpB3B,YAAA,YAAwB,IVoBG,CAAA;EAAO,CAAA,OAAA;uBUfxB;;yCAawB,sBAAsB,kBAAkB,QAAQ;EThC9E,YAAA,CAAA,IAAA,EAAe,MAAA,EAAA,UAAA,ES0Ce,UT1Cf,EAAA,OAAA,ES0CoC,eT1CpC,CAAA,ES0CsD,OT1CtD,CS0C8D,QT1C9D,GAAA,IAAA,CAAA;AAQhC;;;;ADJY,UWCK,eAAA,CXDL;;aAED,EAAA,MAAA;EAAW;EAIL,QAAA,CAAA,EAAA,MAAY;AAuB7B;;;;;AAC+C,cWlBlC,QAAA,YAAoB,IXkBc,CAAA;;uBWdxB;;EVpBN;AAQjB;;;yCU2B+C,qBAAqB,kBAAkB,QAAQ;AT5B9F;;;;AFNiB,UYAA,kBAAA,CZAkB;EAAA,IAAA,EAAA,MAAA;OAGvB,EAAA,MAAA;;;AAEU;AAItB;AAuBA;;;;;AAC+C;;;iBYjB/B,kBAAA,UACL,gCAER;AXpBH;;;ADIY,UaDK,gBAAA,CbCL;;aAED,EAAA,MAAA;AAAW;AAItB;AAuBA;;;AACgD,catBnC,SAAA,YAAqB,IbsBc,CAAA;UAAR;EAAO,WAAA,CAAA,OAAA,EanBxB,gBbmBwB;;2CaVE,sBAAsB,kBAAkB,QAAQ;;AZxBjG;;;;;;ADMsB;AAIL,ccJJ,aAAA,YAAyB,IdMrB,CAAA;EAqBA,IAAA,WAAU,CAAA,CAAA,EAAA,MAAA;EAAA,YAAA,CAAA,KAAA,EAAA,MAAA,EAAA,WAAA,EctBsB,UdsBtB,EAAA,QAAA,EctB4C,edsB5C,CAAA,EctB8D,OdsB9D,CctBsE,QdsBtE,CAAA;;;;;;;AA3BL;AAItB;AAuBiB,cenBJ,eAAA,CfmBc;EAAA,CAAA,OAAA;aACR,CAAA,IAAA,EAAA,MAAA,EAAA,OAAA,EeNkB,sBfMlB;;MAAqB,IAAA,CAAA,CAAA,EAAA,MAAA;EAAO;;;qBekB1B;EdpDJ;EAQJ,IAAA,MAAA,CAAA,CAAA,EAGH,OAAA;;;;ACJV;;;sBa+DsB;EZlEL;AAYjB;;;;;eAOgF,CAAA,UAAA,EY0DpD,UZ1DoD,CAAA,EAAA,IAAA;;;;;AAKQ;aY+DrE;;;AX3FnB;EAYY,UAAA,CAAA,CAAA,EWgGU,OXhGA,CAAA,IAAA,CAAA;EAWL;;;iCAGN,CAAA,CAAA,EAAA,MAAA;EAAM,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWmGiB,OXnGjB,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWmGyD,cXnGzD,CAAA,EWmG0E,OXnG1E,CWmGkF,CXnGlF,CAAA;EAMA,IAAA,CAAA,IAAA,OAAA,CAAc,CAAA,OAAA,EWiGI,OXjGJ,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWiG4C,cXjG5C,CAAA,EWiG6D,OXjG7D,CWiGqE,CXjGrE,CAAA;EAAA,GAAA,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWqGG,OXrGH,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqG2C,cXrG3C,CAAA,EWqG4D,OXrG5D,CWqGoE,CXrGpE,CAAA;QAItB,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWqG4B,OXrG5B,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqGoE,cXrGpE,CAAA,EWqGqF,OXrGrF,CWqG6F,CXrG7F,CAAA;OAEG,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWuGwB,OXvGxB,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWuGgE,cXvGhE,CAAA,EWuGiF,OXvGjF,CWuGyF,CXvGzF,CAAA;;;AAIU;AAUtB;;;QAIgB,CAAA,IAAA,OAAA,CAAA,CAAA,OAAA,EWkGH,OXlGG,EAAA,MAAA,EWmGJ,UXnGI,EAAA,WAAA,EAAA,MAAA,EAAA,OAAA,CAAA,EWqGF,cXrGE,CAAA,EWsGX,OXtGW,CWsGH,CXtGG,CAAA;AAAM"}

package/dist/events-RcqBZBsR.d.ts

@@ -1,185 +0,0 @@
-import { HubConnection } from "@microsoft/signalr";
-
-//#region src/events/types.d.ts
-/**
- * Event listener connection states.
- */
-type EventListenerState = 'starting' | 'connected' | 'disconnected' | 'reconnecting' | 'stopped';
-/**
- * Handler for Safeguard events (NotifyEventAsync messages from SignalR).
- */
-type EventHandler = (event: SafeguardEvent) => void;
-/**
- * Handler for state change notifications.
- */
-type StateChangeHandler = (state: EventListenerState) => void;
-/**
- * A Safeguard event as delivered by SignalR.
- */
-interface SafeguardEvent {
-  EventName: string;
-  [key: string]: unknown;
-}
-/**
- * Options for persistent event listeners.
- */
-interface PersistentListenerOptions {
-  /** Delay between reconnection attempts in milliseconds. Default: 5000. */
-  retryIntervalMs?: number;
-  /** Maximum number of reconnect attempts before giving up. Default: unlimited. */
-  maxRetries?: number;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/events/listener.d.ts
-/**
- * One-shot event listener wrapping a SignalR HubConnection.
- * For persistent auto-reconnect behavior, use PersistentSafeguardEventListener.
- */
-declare class SafeguardEventListener {
-  #private;
-  constructor(connection: HubConnection);
-  /** Current connection state. */
-  get state(): EventListenerState;
-  /**
-   * Register an event handler for Safeguard notifications.
-   */
-  on(_method: 'NotifyEventAsync', handler: EventHandler): this;
-  /**
-   * Start the SignalR connection.
-   */
-  start(): Promise<void>;
-  /**
-   * Stop the SignalR connection.
-   */
-  stop(): Promise<void>;
-}
-//# sourceMappingURL=listener.d.ts.map
-//#endregion
-//#region src/http/types.d.ts
-/**
- * Platform-agnostic HTTP client interface for the Safeguard SDK.
- */
-interface HttpRequestOptions {
-  url: string;
-  method: string;
-  headers?: Record<string, string>;
-  body?: string | Buffer | null;
-  signal?: AbortSignal;
-  timeout?: number;
-}
-interface HttpResponse {
-  status: number;
-  headers: Record<string, string>;
-  body: string;
-}
-/**
- * Abstract HTTP client interface.
- * Implementations: NodeHttpClient (undici), BrowserHttpClient (fetch).
- */
-interface HttpClient {
-  request(options: HttpRequestOptions): Promise<HttpResponse>;
-  dispose?(): void;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/storage/types.d.ts
-/**
- * Interface for token/state storage backends.
- */
-interface StorageProvider {
-  get(key: string): string | null;
-  set(key: string, value: string): void;
-  remove(key: string): void;
-  clear(): void;
-}
-/** Well-known storage keys used by the SDK. */
-//#endregion
-//#region src/secret.d.ts
-/**
- * A wrapper that prevents accidental logging of sensitive values.
- *
- * - `toString()` returns "[REDACTED]"
- * - `toJSON()` returns "[REDACTED]"
- * - `console.log(secretValue)` prints "[REDACTED]"
- * - `.expose()` returns the raw value when intentionally needed
- */
-declare class SecretValue {
-  #private;
-  constructor(value: string);
-  /** Returns the raw secret. Use only when you intentionally need the plaintext. */
-  expose(): string;
-  toString(): string;
-  toJSON(): string;
-  get [Symbol.toStringTag](): string;
-}
-//# sourceMappingURL=secret.d.ts.map
-//#endregion
-//#region src/auth/types.d.ts
-/**
- * Token set returned by authentication.
- */
-interface TokenSet {
-  /** The Safeguard user access token (wrapped to prevent accidental logging). */
-  accessToken: SecretValue;
-  /** Token lifetime in seconds from when it was issued. */
-  expiresIn?: number;
-  /** Timestamp (ms since epoch) when the token was acquired. */
-  acquiredAt: number;
-}
-/**
- * Auth strategy interface. All authentication methods implement this.
- */
-interface Auth {
-  /**
-   * Authenticate against the Safeguard RSTS and return a token set.
-   * @param host - Appliance hostname
-   * @param httpClient - HTTP client to use for requests
-   * @param storage - Storage provider for persisting tokens/state
-   */
-  authenticate(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet>;
-  /**
-   * Refresh the token if possible. Returns new token set or null if refresh not supported.
-   */
-  refreshToken?(host: string, httpClient: HttpClient, storage: StorageProvider): Promise<TokenSet | null>;
-  /** Human-readable description of this auth strategy (for logging). */
-  readonly description: string;
-}
-//# sourceMappingURL=types.d.ts.map
-//#endregion
-//#region src/events/persistent.d.ts
-/**
- * Persistent event listener with automatic reconnection and token refresh.
- *
- * Wraps SignalR's built-in `withAutomaticReconnect()` AND adds:
- * - Token refresh on reconnect (re-authenticates if needed)
- * - State change event notifications
- * - Manual `stop()` that prevents further auto-reconnect
- */
-declare class PersistentSafeguardEventListener {
-  #private;
-  constructor(connection: HubConnection, auth: Auth, host: string, httpClient: HttpClient, storage: StorageProvider, options?: PersistentListenerOptions, tokenSet?: TokenSet);
-  /** Current connection state. */
-  get state(): EventListenerState;
-  /**
-   * Register an event handler for Safeguard notifications.
-   */
-  on(_method: 'NotifyEventAsync', handler: EventHandler): this;
-  /**
-   * Register a state change handler.
-   */
-  onStateChange(handler: StateChangeHandler): this;
-  /**
-   * Start the persistent connection.
-   */
-  start(): Promise<void>;
-  /**
-   * Stop the connection. Prevents auto-reconnect.
-   */
-  stop(): Promise<void>;
-}
-//# sourceMappingURL=persistent.d.ts.map
-
-//#endregion
-export { type EventHandler, type EventListenerState, type PersistentListenerOptions, PersistentSafeguardEventListener, type SafeguardEvent, SafeguardEventListener, type StateChangeHandler };
-//# sourceMappingURL=events-RcqBZBsR.d.ts.map

package/dist/events-RcqBZBsR.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"events-RcqBZBsR.d.ts","names":[],"sources":["../src/events/types.ts","../src/events/listener.ts","../src/http/types.ts","../src/storage/types.ts","../src/secret.ts","../src/auth/types.ts","../src/events/persistent.ts"],"mappings":";;;;;;AAGY,KAAA,kBAAA,GAAkB,UAAA,GAAA,WAAA,GAAA,cAAA,GAAA,cAAA,GAAA,SAAA;AAU9B;AAKA;AAKA;AAQiB,KAlBL,YAAA,GAkBK,CAAA,KAAyB,EAlBP,cAkBO,EAAA,GAAA,IAAA;;;;ACxB7B,KDWD,kBAAA,GCXuB,CAAA,KAAA,EDWM,kBCXN,EAAA,GAAA,IAAA;;;;AAoCQ,UDpB1B,cAAA,CCoB0B;WAQ1B,EAAA,MAAA;MASD,EAAA,MAAA,CAAA,EAAA,OAAA;AAAO;;;;ACxDN,UF2BA,yBAAA,CE3BkB;EAAA;iBAGvB,CAAA,EAAA,MAAA;;YAED,CAAA,EAAA,MAAA;AAAW;AAItB;;;;AFVA;AAUA;AAKA;AAKiB,cChBJ,sBAAA,CDgBkB;EAQd,CAAA,OAAA;0BCnBS;;eAwBX;EA7BF;;;KA6BE,OAAA,EAAA,kBAAA,EAAA,OAAA,EAO4B,YAP5B,CAAA,EAAA,IAAA;;;;EAwBQ,KAAA,CAAA,CAAA,EATN,OASM,CAAA,IAAA,CAAA;;;;ECxDN,IAAA,CAAA,CAAA,EDwDD,OCxDC,CAAA,IAAA,CAAkB;;;;;;;;AFDvB,UECK,kBAAA,CFDa;EAUlB,GAAA,EAAA,MAAA;EAKA,MAAA,EAAA,MAAA;EAKK,OAAA,CAAA,EEhBL,MFgBK,CAAc,MAAA,EAAA,MAAA,CAAA;EAQd,IAAA,CAAA,EAAA,MAAA,GEvBC,MFuBD,GAAA,IAAyB;WEtB/B;;;ADFE,UCMI,YAAA,CDNkB;EAAA,MAAA,EAAA,MAAA;SAKT,ECGf,MDHe,CAAA,MAAA,EAAA,MAAA,CAAA;MAwBX,EAAA,MAAA;;ACvBf;AAuBA;;;AACgD,UAD/B,UAAA,CAC+B;SAAR,CAAA,OAAA,EAArB,kBAAqB,CAAA,EAAA,OAAA,CAAQ,YAAR,CAAA;EAAO,OAAA,GAAA,EAAA,IAAA;;;;;;;;AFlCnC,UGAK,eAAA,CHAa;EAUlB,GAAA,CAAA,GAAA,EAAA,MAAY,CAAA,EAAA,MAAA,GAAW,IAAA;EAKvB,GAAA,CAAA,GAAA,EAAA,MAAA,EAAA,KAAkB,EAAA,MAAA,CAAW,EAAA,IAAA;EAKxB,MAAA,CAAA,GAAA,EAAA,MAAc,CAAA,EAAA,IAAA;EAQd,KAAA,EAAA,EAAA,IAAA;;;;;;;;AA5BjB;AAUA;AAKA;AAKA;AAQA;cIrBa,WAAA;;;EHHA;EAAsB,MAAA,CAAA,CAAA,EAAA,MAAA;UAKT,CAAA,CAAA,EAAA,MAAA;QAwBX,CAAA,CAAA,EAAA,MAAA;OGDR,MAAA,CAAO,WAAW,GHQkB,EAAA,MAAA;;;;;ADxC3C;AAUA;AAKA;AAKiB,UKhBA,QAAA,CLgBc;EAQd;eKtBF;;;EJFF;EAAsB,UAAA,EAAA,MAAA;;;;;AAqDnB,UIzCC,IAAA,CJyCD;EAAO;;;;ACxDvB;;cAGY,CAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EGmB6B,UHnB7B,EAAA,OAAA,EGmBkD,eHnBlD,CAAA,EGmBoE,OHnBpE,CGmB4E,QHnB5E,CAAA;;;AAEU;EAIL,YAAA,EAAA,IAAY,EAAA,MAElB,EAAA,UAAM,EGgByB,UHhBzB,EAAA,OAAA,EGgB8C,eHhB9C,CAAA,EGgBgE,OHhBhE,CGgBwE,QHhBxE,GAAA,IAAA,CAAA;EAqBA;EAAU,SAAA,WAAA,EAAA,MAAA;;;;;AFlB3B;AAKA;AAQA;;;;ACxBA;;AAK0B,cKWb,gCAAA,CLXa;UAwBX;aAO4B,CAAA,UAAA,EKF3B,aLE2B,EAAA,IAAA,EKDjC,ILCiC,EAAA,IAAA,EAAA,MAAA,EAAA,UAAA,EKC3B,ULD2B,EAAA,OAAA,EKE9B,eLF8B,EAAA,OAAA,CAAA,EKG7B,yBLH6B,EAAA,QAAA,CAAA,EKI5B,QLJ4B;;MAiB3B,KAAA,CAAA,CAAA,EKsBD,kBLtBC;EAAO;;;2CK6BoB;EJrF1B;;;eAIC,CAAA,OAAA,EIyFO,kBJzFP,CAAA,EAAA,IAAA;;AACI;AAItB;EAuBiB,KAAA,CAAA,CAAA,EIqEA,OJrEU,CAAA,IAAA,CAAA;EAAA;;;MACa,CAAA,CAAA,EI+ExB,OJ/EwB,CAAA,IAAA,CAAA;AAAO"}